KR100453616B1 - Method, article and apparatus for registering registrants, such as voter registrants - Google Patents

Abstract

A registrant submits a public key of a public/private key pair and identifying information to a registrar. The registrar determines whether the registrant is eligible based on the provided identifying information. The registrar digitally signs the public keys of eligible registrants and forwards the signed public keys to an authenticating authority. Alternatively, the registrant produces a hash card including a hash of the registrant's public key and signs and submits the hash card to the registrar via a courier. The registrant then submits its public key, the registrar electronically. If the hash corresponds to the submitted public key, the registrar digitally signs the public key and forwards the digitally signed public key to an authenticating authority. Alternatively, the registrar identifies a registrant in-person, and provides the registrant with a private key in a secure manner, then forwards a digitally signed public key to the authenticating authority. Alternatively, the registrant produces a hash card including a hash of its public key and signs and submits the hash card to the registrar in-person. The registrant then electronically submits the public key to a registrar. The registrar digitally signs the public key if the hash corresponds to the electronically submitted public key. The registrar forwards the digitally signed public key to an authenticating authority for use in authenticating the source of the encrypted information submitted by the registrant.

Description

Method for registering registrants, such as voter registrants, computer readable media, voter registrant computer systems {Method, article and apparatus for registering registrants, such as voter registrants}

Since the Internet facilitates electronic communication with large databases, between individuals and between sellers and buyers, various activities, including research, communication or document exchange, and "electronic commerce" are part of Its use is increasing. The Internet has a number of computers and computer networks interconnected through communication channels. An individual can use a personal computer to access another computer via the Internet. While many commercial transactions today can be conducted electronically, the acceptance and widespread use of electronic commerce depends in large part on the ease of use and the verifiability of the transaction in carrying out such e-commerce or other activities. do. For example, if electronic commerce can be easily executed, even a novice computer user will want to engage in such activities. Therefore, it is important that technologies be developed to facilitate such activities electronically.

Because the Internet uses standardized techniques for exchanging information, it facilitates electronically performing some activities. Many standards have been established for exchanging information over the Internet, such as e-mail, Gopher, and the World Wide Web ("WWW"). The WWW service allows a server computer system (ie, a web server or website) to send graphical web pages of information to a remote client computer system. The remote client computer system can then display the web pages. Each resource of the WWW (eg, computer or web page) can be uniquely identified by a standard resource location indication (“uniform resource locator”). To view a particular web page, the client computer system specifies the URL for that web page in the request (ie, a HyperText Transfer Protocol (HTTP) request). This request is sent to a web server that supports the web page. When the web server receives the request, the web server sends the requested web page to the client computer system. When the client computer system receives the web page, it typically displays the web page using a browser. The browser is a special purpose application for requesting and displaying web pages.

Currently, web pages are defined using the HyperText Markup Language ("HTML"), although other standards clearly exist. HTML provides a set of tags that specify how web pages are displayed. When the user makes a request to the browser to display a web page, the browser sends the request to the server computer system and sends an HTML document defining the web page to the client computer system. When the requested HTML document is received by the client computer system, the browser displays a web page defined by the HTML document. The HTML document contains various tags that control the display of text, graphics, controls and other features. The HTML document may include URLs of other web pages available on the server computer system or other server computer systems.

The world wide web portion of the Internet particularly helps to host e-commerce and other activities that individuals have previously performed manually or over the telephone. One activity that was difficult to transmit to the Internet or the World Wide Web was the exercise of voting rights. Electronic voting methods should not only ensure the privacy of each voter, but also provide security to prevent cheating. Voter registration has typically provided several ways to prevent voter fraud. Typically, conventional voting methods go through a two-step process. First, the voter registers and provides the voter's signature to the registrar. Second, the voter's signature on the electoral roll or the envelope enclosed with the anonymous ballot, so that the voter's signature is later compared to the registrant's signature. For many e-commerce technologies, the electronic voting method is easy to use and access, and requires stringent proof requirements. To date, the inventors have not known any system that fulfills these requirements.

FIELD OF THE INVENTION The present invention generally relates to registering registrants, such as voters or polling registrants, and more particularly to the use of public / private key encryption during the registration process.

1 is a block diagram illustrating an environment for use in an embodiment of the invention.

2 is a flow diagram of a first method of registering registrants, wherein the registrant submits the public key and identification information of the public / private key pair to the registrar, the registrar having the registrant's legitimacy based on the duplication and matches in the identification data To determine, flow chart.

3 is a flow diagram of a second method of registering registrants, wherein the registrant sends a hash and signature of the public key to the registrar through a career and electronically sends the public key to the registrar.

4 is a flowchart of a third method of registering registrants, wherein the registrar directly identifies the registrant's identity and generates a public / private pair for the identified registrant.

5 is a flowchart of a fourth method of registering registrants, wherein the registrant electronically submits the public key to the registrar and submits the hash and signature of the public key directly to the registrar.

According to one aspect of the present invention, a registrant submits public and identification information of a public / private key pair to a registration authority. The registrar determines whether the registrant is eligible based on the identification information provided. The registrar digitally signs the legitimate registrant's public keys and sends the signed public keys to the certification authority for use in authenticating the source of electronic voting or encrypted voting information submitted by the registrant.

Under another aspect of the present invention, a registrant generates a hash card that includes a hash of the public key of the registrant's public / private key pair. The registrant physically signs and submits the hash card to the registrar through a communication channel such as a common courier. The registrant then submits the public key electronically to the registrar. If this hash corresponds to a submitted public key, the registrar will digitally sign this public key and use it to authenticate the digital authority to the certification authority for use in authenticating the source of electronic voting or encrypted voting information submitted by the registrant. Send a publicly signed public key.

In another aspect of the present invention, the registration authority directly identifies the registrant and provides the registrant with the secret key of the public / private key pair in a secure manner as in removable media. The registrant sends a digitally signed public key to the certification authority for use in authenticating the source of electronic voting or encrypted voting information submitted by the registrant.

Under another aspect of the invention, the registrant creates a hash card that includes a hash of the public key of the registrant's public / private key pair. The registrant signs and submits the hash card directly to the registrar. The registrant submits the public key electronically to the registrar. If the hash corresponds to the electronically submitted public key, the registrar digitally signs the public key. The registrar sends this digitally signed public key to the certification authority for use in authenticating the source of electronic voting or encrypted voting information submitted by the registrant.

In the drawings, reference numerals indicate similar elements or operations. The relative positions and sizes of elements in the figures are not necessarily drawn to scale. For example, the various elements and the shapes of the angles have not been drawn to scale, and some of these elements have been arbitrarily enlarged and positioned to make the drawing easier to see. Moreover, the specific shapes of the elements as shown are not intended to contain any information about the actual shapes of these specific shapes, but have been chosen only to make them recognizable in the drawings. In the following description, certain specific details are set forth in the invention. It is described to provide a thorough understanding of various embodiments of the present invention. However, one of ordinary skill in the art will appreciate that the invention may be practiced without these details. In other instances, well known structures associated with computers, networks and servers and clients are not shown or described in detail in order to avoid unnecessarily obscure descriptions of embodiments of the present invention.

Unless the context requires otherwise, the words "comprise" and "including" in the following specification and claims should be interpreted in an open and inclusive sense, that is, including, but not limited to Not ".

The headings provided herein are for the convenience and do not interpret the scope of the claimed invention.

Some of the detailed descriptions provided herein are expressly disclosed in commonly assigned US Provisional Application No. 60 / 149,621, filed August 16, 1999, with many additional details being provided by those skilled in the art. It will be appreciated that in the detailed description provided below it is known or known to those skilled in the art. Those skilled in the art can easily implement aspects of the present invention based on the detailed description provided in this provisional application.

Voter Certification Background

To facilitate the description, this disclosure uses a specific example of voter registration to illustrate the more general concept of public / private key encryption used in practical registration systems. In the illustrated examples, the registrar corresponds to the voter, the registrar corresponds to the organization in which the election is held (eg, municipality, state, county, union, club), and / or its employees and agents, The certification body corresponds to the presence of counting and counting votes. Note from the outset that the certification body can be a third party individual, organization or other organization. Alternatively, the certification authority may be a registration authority or a component of a registration authority. Although the illustrated examples used elections based on scenarios, registration systems could be used in other situations, such as voting, licensing, lottery drawing or contests. Accordingly, the embodiments selected to illustrate are not to be considered limiting.

The registration systems exemplified herein provide each qualified registrant with a method to obtain a public / private pair that satisfies a given format and security specifications of the registrar and / or certification authority. In addition, it must be distributed to the organization (ie, the "registration authority") where each eligible registrant's public key authenticates the registration, and that organization maintains a record of each eligible registrant's public key. The agency can provide software that allows each voter to create a public / private pair on their computer, thereby maintaining high security and privacy.The public key intends it to be "public". It can be distributed to a certification authority by most arbitrary means, since public / private pair-generation software is generally available, the protocols herein are public keys for future registrants generated by some illegal source. Should be implemented to protect the organization (eg, a governmental entity) from receiving and recording such information. For purposes purposes, the masquerader has been impersonating someone else's identity.Without these protocols, the organization can ensure that trusted votes for people on the list of eligible voters are counted in the final accounting. However, there is no guarantee that the source of each vote is actually a trusted voter.

The proper identification of prospective registrants and recording the public key of each prospective voter registrant is called the registration process. Each organization or government entity must complete this process at least once for each eligible registrant (eg, voters). Moreover, the registration process needs to be completed only once for each eligible voter, except in special circumstances, for example, if the eligible voter loses his private key, or if it feels compromised. . (The same key pairs can be reused in successive elections.) The four methods or protocols for performing the registration process are used herein to help each organization balance the security and convenience with which it deems most appropriate. To provide. They are provided in FIGS. 2 to 5 respectively to increase security and reduce access convenience.

It should be noted that all of the protocols disclosed below assume that a voter creates a public / private pair using a proven program distributed by a registrar and / or certification authority. The problem of ensuring the use of proven programs is the considered Key Generator Distribution Problem, which can be solved by distributing public / private key pairing software on secure media.

Example

1 and the following discussion provide a simple general description of a suitable computing environment in which aspects of the invention may be implemented. Although not required, embodiments of the invention are disclosed in the general context of computer-executable instructions, such as routines, executed by a general purpose computer such as a personal computer or a web server. Those skilled in the art will appreciate that aspects of the present invention (such as small elections) may be used in Internet applications, portable devices, multiprocessor systems, microprocessor-based or programmable consumer electronics devices, network PCs, minicomputers, It will be appreciated that it may be implemented with other computer system configurations, including cell phones, mainframe computers, and the like. Aspects of the invention may be embodied in a particular purpose computer or data processor that is specifically programmed and configured to perform one or more computer-executable instructions described herein. The invention may also be practiced in distributed computing environments where tasks or modules are performed by remote processing devices that are linked through a communications network such as a local area network (LAN), a wide area network (WAN), and the Internet. Can be. In a distributed computing environment, program modules or sub-routines may be located in local and remote memory storage devices. Thus, the present invention is not limited to the World Wide Web or the Internet.

Although not disclosed otherwise, the configuration and operation of the various blocks shown in FIG. 1 are of conventional design. As a result, such blocks do not need to be described in more detail here as those skilled in the art will readily understand.

Referring to FIG. 1, a suitable environment of the system 100 includes one or more voters and client computers 102, each of which contains data to the Internet where the computer includes a website within the World Wide Web portion 106 of the Internet. Browser program module 104 to allow access and exchange of. Voter computers 102 may include one or more central processing units or other logic processing circuitry, memory, input devices (eg, keyboard and pointing devices), output devices, which are not well illustrated in FIG. 1. (Eg, display devices and printers), and storage devices (eg, fixed, floppy and optical disk drives). Voter computers 102 may also include other program modules, such as an operating system, one or more application programs (eg, word processing or spreadsheet applications), and the like. Additionally, voter computers may include public / private pair generation program module 105. As shown in FIG. 1, there are N voter computers 102 representing voters 1, 2, 3,..., N. FIG.

The certification authority's server computer system 108 connected to the Internet or the World Wide Web ("Web") 106 performs many or all of the ballot counting, storage, and other processes. Database 110 connected to server computer 108 includes many web pages and data (votes) exchanged between voter computers 102, one or more voting poll computers 112, and server computer 108. Save). Polling place computer 112 may be a personal computer placed at a public voting site to allow public members or voters who do not have easy access to computers connected to the Internet 106 to vote electronically under the systems described herein; Server computers, mini-computers and the like. Therefore, voter computers 102 may be located in the home of an individual voter, and one or more polling station computers 112 may be publicly located, otherwise access to voters during a public election. Polling place computer 112 may include a local area network (LAN) having one server computer and several client computers or voter terminals connected to it via a LAN, thereby allowing several voters to vote simultaneously or in parallel. Allowed.

The certification authority server computer 108 includes the server engine 120, the web page management element 122, and the data management element 124 as well as other elements. In addition to the standard functions, the server engine 120 may refer to the invention of the "Multi-way Election Method and Apparatus" filed on March 24, 2000, assigned to the same assignee as the present invention. Having a US patent application number Perform one or more electronic voting protocols, such as those described in the call. Thus, server engine 120 may be authorized to vote, vote counting, voting confirmation (e.g., passing a confirmation that checks digital signatures and includes proof of voting validity), voting population, voting decryption, and / or Alternatively, all mandatory vote transfers may be made to the vote list.

Web page element 122 handles the creation and display or routing of web pages, such as electronic ballot box web pages. Voters and users access server computer 108 by an associated URL, such as http://www.votehere.net, or a URL associated with an election, such as a URL to a municipality. The municipality may host or operate the server computer system 108 directly with the certification authority, or may automatically send such received electronic votes to a third party voting certification authority that may operate the server computer system. . The URL or any link or address specified herein may be any resource locator.

Web page management process 122 and server computer 108 may have secure sections or pages that can only be accessed by authorized people, such as authorized voters or system administrators. Server computer 108 may employ a secure socket layer (“SSL”) and tokens or cookies to authenticate such users. Indeed, for small elections or elections with low likelihood of cheating (or relatively insignificant consequences of cheating), the system 100 is less than using complex electronically encrypted votes, as described in the patent application specified above. As described, one may employ simple network security methods for collecting and storing votes. Methods of authenticating users (via use of a password), establishing secure transport connections, and providing secure servers and web pages are known to those skilled in the art.

One or more registrar's server computer systems 114 are also connected to the voter or client computers 102 via the certification authority's server computer system 108 and the Internet 106. The registrar's server computer system 114 verifies and registers registrants (e.g., voters), digitally signs the registrar's public keys, and registers with the registrar's server computer system 108. Performs many or all registration processes that pass through the institutions' digitally signed public keys. The database 115 connected to the registrar's server computer system 114 stores a number of web pages and data exchanged between the registrar's server computer 114, the voter computers 102, and the certification authority's server computer 108. Save it.

The registrar's server computer 114 includes a server engine 130, a web page management element 132, and a database management element 134 as well as other elements. Server engine 130 may perform one or more registration protocols, such as the registration protocols described herein, in addition to standard functions.

The web page element 132 handles the creation and display or routing of web pages, such as electronic ballot box web pages. Voters and users access the registrar's server computer 114 by an associated URL, such as http://www.votehere.net, or an URL associated with an election, such as a URL for a municipal agency. The municipal authority may host or operate the registrar's server computer system 114 directly as a certification authority, or automatically transmit these received electronic votes to a third party certification authority that may operate the server computer system. have. The URL or any link or address recorded here may be any resource location indication.

The web page management process 132 and the registrar's server computer 114 may have secure sections or pages that can only be accessed by authorized people, such as authorized voters or system administrators. The registrar's server computer 114 may use SSL and tokens or cookies to prove these users.

Under alternative embodiments, system 100 may be used in a private election context, such as the election of executives of corporations or members of committees. Under this embodiment, the voter computers 102 may be laptops or desktop computers of shareholders, and the polling station computer 112 may be one or more computers located within the company (eg, in the lobby) of the company conducting the election. have. Therefore, shareholders may visit the company to access polling station computer 112 to register and / or throw their pros and cons. Under another alternative embodiment, the system 100 may be used in an environment of market research or opinion voting where an entity delegating a survey or vote wants data collected from a particular public demographic segment. have. The registration process can ensure that the population requirements are met while retaining anonymous respondents. Under another alternative embodiment, system 100 may be used in the context of a lottery or contest by controlling the registration for the lottery or contest. Registration processing can ensure that competitors meet any eligibility criteria, such as age or housing requirements, while remaining anonymous. In another alternative embodiment, system 100 may be used in a licensed environment, such as, for example, a licensed individual, cars, boats, or other items.

Remote electronic registration

2 illustrates a method of remote electronic registration 200. The method is more convenient for registration than other illustrated methods, but can be less secure. In Figures 2-5, in general, the flow sequence is from the top of the page to the bottom of the page, although the order of many steps may be exchanged. Each column 202-206, 302-306, 402-406, 502-506 of FIGS. 2-5 is a participant, although in many cases the actions of the registrar and certification authority can be performed by the others. Explain one of the actions. In some respects, standards are created by registrars and certification bodies, which include the behavior of their employees, contractors, agents, and systems such as programmed computers and databases.

In step 208, registration authority 204 provides a registration form web page to registrant 202 via the world wide web. Alternatively, the registration form web page may be provided by the certification authority 206.

In step 210, the certification authority 206 provides the registrant 202 with public / private pair generation software. The certification authority 206 may, for example, provide software at the request of the registrant 202 in response to the selection of a link on the registration form web page. Alternatively, registrar 204 may provide public / private pair generation software. Since the registrant 202 ensures that no one handles the secret key, maintaining the software on the registrant 202's own computer provides an increased degree of security. In some cases, for example, if the registrant 202 already processes the appropriate software or has a public / private pair according to the specifications of the certification authority 206 and / or the registrar 204, the public / private key. Downloading pair generation software may not be necessary. Note that in some examples step 210 may proceed to step 208.

In step 212, the registrant 202 creates a public / private pair. The registrant 202 can use the public / private pair generation software downloaded in step 210 or according to the previously downloaded public / private pair generation software. Alternatively, registrant 202 may use a public / private pair previously generated according to the specifications of certificate authority 206 or registrar 204. Public / private pair encryption is known to those skilled in the art of cryptography, and for the sake of brevity, the details of such techniques will not be described.

At step 214, registrant 202 submits the public and identification information of the public / private key pair for registrar 204. The identification information may include any data in a predetermined format, but will typically include the name and address of the registrant 202. The address may be a postal address, an e-mail address and / or another address. For example, universities prefer email addresses, while municipalities may prefer public street addresses. The identification information may also include a unique identifier, such as a social security number or other universally assigned identifier.

In step 216, registration authority 204 receives the public key and identification information. In step 218, registrar 204 determines whether registrant 202 is eligible based on the submitted identification information. For example, registrar 204 may determine whether a submitted name matches a known address for registrant 202. In addition, registrar 204 may determine whether the name and address for registrant 202 matches a known name and address, such as previous voting records, and / or telephone and address book. In addition, the registrar 204 may determine whether the name and address overlap with previously registered names and addresses. These decisions may detect attempts at voter fraud, although it may not be immediately apparent whether the current registrant 202 or previous registrar attempts to commit fraud. Thus, the method of FIG. 2 provides some level of security during the registration process.

If registrant 202 is not suitable, registrar 204 may decline registration at step 220 and take additional steps to identify the source of the attempted fraud. If registrant 202 is appropriate, registrar 204 digitally signs registrant 202's public key at step 222. Digital signatures are known to those skilled in the art of cryptography and will not be discussed further.

In optional step 224, registrar 204 may provide digitally signed public key to registrant 202 to be used as a confirmation of registration. (Optional steps are noted by parentheses surrounding the step labels in FIGS. 2-5.) In step 226, the registration authority 204 sends the digitally signed public key to the certificate authority 206. to provide. Note that the order of steps 224 and 226 can be changed as desired. Typically, registrar 204 supplies the certificate authority 206 with a set of all digitally signed public keys at the end of the registration period, but also digitally signed public keys based on each one of which they generate. Can be supplied. In step 228, the certification authority 206 receives a digitally signed public key from the registration authority 204.

At step 230, registrant 202 sends an encrypted ballot to certification authority 206 receiving an encrypted ballot from registrant 202 at step 232. In some cases, it is possible to perform step 230 and step 232 before step 228. However, the order shown in FIG. 2 may cause the certification authority 206 to refuse to receive votes from registrants for which a digitally signed public key was not previously received.

In step 234, the certification authority 206 authenticates the source of the encrypted vote using the public key of the registrant 202 digitally signed by the registrar. Authentication verifies the registrant's digital signature on an encrypted ballot. Thus, the protocol authenticates the encrypted ballot using the public key of the registrant 202 authenticated using the digital signature of the registrar 204. The certification authority 206 may authenticate each vote when an encrypted vote is received, or may delay the authentication of the votes at the end of the voting period and until all encrypted votes have been received. In step 236, the certification authority 206 aggregates the encrypted votes, and in step 238 decrypts the aggregation of the encrypted votes. Decryption is a multiway described in US Patent Application No. 32462.8001US, filed March 24, 2000, entitled " MULTIWAY ELECTION METHOD AND APPARATUS. &Quot; Achieved using a multiway protocol.

Post / Courier Registration

3 shows a registration method using a career such as a postman or another common carrier. This method is generally safer than the method of FIG. 2, but is also less convenient for registrants.

In step 308, registration authority 304 provides a registration form web page to the registrant via WWW, and in step 210, certification authority 306 provides public / private pair generation software to the registrant. As generally discussed above, the order of steps 308 and 310 may vary so that the certification authority 306 as well as the roles of the registration authority 304 may be suitable for specific circumstances. In step 312, the registrant creates a public / private pair, or uses an existing public / private pair that conforms to the specifications of the registrar 304 or the certification authority 306. In step 314, the registrant generates a hash of the public key. Hashing functions are generally known in the computer art and will not be discussed further.

In step 316, the registrant forwards the hash of the public key to hash card 317. The hash card 317 is formed on a blank of a tangible medium capable of conveying the registrant's signature as well as the hash of the public key. For example, hash card 317 may be formed on a blank of paper, poster-board, or card-board. The hash card 317 may alternatively use a kind of destruction-resistant material, such as TYVEK (registered trademark of E.I. DuPont de Nemours and Company). The registrant can create or obtain the hash card 317 in various types. For example, a registrant can print a hash card on standard paper using a trusted printer. The registrant can obtain a hash card blank from publicly available sources such as a driver's license bureau, post office, store and / or supermarket. The registrant can send the hash card blank via mail. The hash card blank may include some preliminary prints or may be fully printed by the registrant. The hash of the public key may be sent to the hash card blank in printing, writing, magnetic encoding or other print form.

In step 318, the registrant provides the registrant's write signature to the hash card blank, thus providing a method for verifying the registrant 302 later. In step 320, registrant 302 delivers the completed hash card 317 to registrar 304, via mail, or by another carrier, including manual delivery, through a third party career. By using a third party career, it provides convenience to the registrant 302, but the stability of the overall system is slightly reduced. In step 322, registration authority 304 receives hash card 317 from registrant 302. In step 324, registration authority 304 enters a hash of the public key into the electronic database to complete the first step of the registration process.

In optional step 326, registrar 304 allows registrant 302 to access the second step of the registration process via a second step web registration page. Alternatively, registrant 302 can automatically access the second stage of the registration process. In step 328, registration authority 304 provides a second step web page registration form to registrant 302. In step 330, registrant 302 submits the public key to registrar 304 via a second stage web page registration form, which registrar 304 publishes from registrar 302 in step 332. Receive the key. In step 334, registration authority 304 determines whether the received hash of the public key corresponds to the received public key. Registration authority 304 may generate a hash of the public key received in the determination.

If the received public key does not correspond to a hash of the public key, the registration authority 304 may deny registration at step 336 and take additional steps to identify the source of the attempted fraud. If the received public key corresponds to a hash of the public key, the registration authority 304 digitally signs the public key of the registrant 302 at step 338. In step 340, registration authority 304 provides digitally signed public key to certificate authority 306, and in step 342 receives a digitally signed public key. Again, registrar 304 may deliver the digitally signed keys to one or more groups. In optional step 344, registrar 304 also provides registrant 302 with a digitally signed public key as confirmation of the registration process. By doing so, the registrant 302 or a third party can later confirm the voting results. The registrant 302 receives the digitally signed public key at step 348.

In step 348, registrant 302 sends an encrypted ballot to certification authority 306, and in step 350 receives the encrypted ballot. In step 352, the certification authority 306 authenticates the source of the encrypted vote using the public key of the registrant 302 digitally signed by the registrar. This authentication verifies the digital signature of the registrant of the encrypted ballot. Therefore, the protocol authenticates the encrypted vote using the registrant 302's public key, and the public key itself is authenticated using the digital signature of the registrar 304. The certification authority 306 may authenticate each vote when an encrypted vote is received, or delay the authentication of the vote until all encrypted votes have been received by the end of the voting period. In step 354, the certification authority 306 aggregates the encrypted votes, and in step 356 decrypts the aggregation of the encrypted votes. The decryption is filed on March 24, 2000, and is described in US Patent Application _________, entitled "MULTIWAY ELECTION METHOD AND APPARATUS" (Agent No. 32462.8001US). This is done using the way protocol.

Direct Registration by a Enrolled Registrar

4 illustrates a registration method that uses a registration authority 404 to generate a public / private pair. If registrar 402 entrusts registrar 404, this method provides more security than the method of FIG. 3, but may be inconvenient than the method discussed above.

In step 408, registrar 404 directly verifies registrant 402. The registrar 404 may rely on the form of a photo identification, such as, for example, a driver's license, passport or National Identification Card. In addition, registrar 404 may rely on the signature, fingerprint, or fact that registrar 404 recognizes registrant 402 as the individual requested by registrant 402. The registrar 404 may set up an office in the relevant area to facilitate the process at the registrant 402. The registrar 404 may use existing facilities such as post offices, schools, driver's license bureaus, shops and / or supermarkets.

At step 408, registrar 404 generates a public / private pair for the identified registrant 402. The public / private pair may be generated after the registrant 402 is verified or before the verification. At step 412, registrar 404 digitally signs the generated public key for the verified registrant 402. At step 414, registrar 404 provides the registrant 402 with the secret key of the public / private key pair. In optional step 416, registrar 404 provides digitally signed public key to registrant 402 as confirmation of the registration process. As mentioned above, the digitally signed public key can later be used to verify the integrity of the election process. The registrar 404 may provide the registrant 402 with a secret key and a digitally signed public key via computer readable removable media or any secure channel. This helps to keep the secret key secret. At step 418, registrant 402 receives a digitally signed public key and a removable medium containing a secret key.

In step 420, the registration authority 404 provides the digitally signed public key to the certificate authority 406, which receives the digitally signed public key in step 422. At step 424, registrant 402 sends an encrypted ballot to certification authority 406 which receives the encrypted ballot at step 426. At step 428, the certification authority 406 authenticates the source of the encrypted vote using the public key of the registrant 402 digitally signed by the registrar. The authentication ratifies the registrant's digital signature on the encrypted ballot. Thus, the protocol authenticates the encrypted vote using the public key of the authenticated registrant 402 using the digital signature of the registrar 404. The certification authority 406 may authenticate each ballot when an encrypted ballot is received, or may delay authentication of the ballots until the ballot period expires and all encrypted ballots are received. In step 430, the certification authority 406 aggregates the encrypted votes, and in step 432 decrypts the aggregation of the encrypted votes. Decryption is disclosed in U.S. Patent Application No. _________ entitled "MULTIWAY ELECTION METHOD AND APPARATUS" (Agent No. 32462.8001US), filed March 24, 2000. Achieved using the multiway protocol.

Private, direct registration

5 shows a registration method that employs direct verification with the registrant 502 who created the public / private key pair. This is the safest of the methods shown, but can be inconvenient.

In step 508, registrar 504 provides a registrant 502 with a web page registration form. In optional step 510, registrar 504 prompts registrant 502 to generate hash card 519. At step 512, if registrant 502 has not yet owned the software or an appropriate public / private pair, registrar 504 may provide the registrant 502 with public / private pair generation software. In step 514, the registrant 502 generates a public / private pair using public / private pair generation software. As described above, the order of the steps and the roles of the registration authority 504 and the certification authority 506 may vary. At step 516, registrar 502 generates a hash of the public key. At step 518, the registrant 502 tensions the hash of the public key to the hash card blank, as described above with reference to the method of FIG.

In step 520, registrar 504 prompts registrant 502 to send the public key. In step 522, registrant 502 sends the public key, and registrar 404 receives the public key in step 524. Note that steps 520, 522, and 524 can occur before steps 516 and 518. In step 526, registrar 504 directly identifies registrant 502 using similar means as described above in connection with the method of FIG. After registrar 504 verifies registrant 502, at step 528 registrar 502 signs hash card 519 and submits the hash card to registrar 504. The registrar 504 receives the signed hash card at step 530, and at step 532 determines whether the hash on the hash card 519 matches the public key submitted electronically by the registrant 502.

At step 534, registration authority 504 rejects registration if the hash of the public key does not match the electronic key submitted electronically. In step 536, registrar 504 verifies that registrant 502 is a qualified person if the hash of the public key matches the electronically submitted public key. In optional step 538, registrar 504 forwards a notarized or otherwise authenticated copy of the hash card to registrant 502 as confirmation of the registration process, and registrar 502 at step 540. Receive a copy of. In step 542, the registration authority 504 digitally signs the public key of the eligible registrant 502. In optional step 544, registrar 504 sends the digitally signed public key to registrant 502 as further confirmation, which registrar 502 receives in step 546. Note that steps 542, 544 and 546 can occur before steps 538 and 540.

In step 548, the registration authority 504 sends the digitally signed public key to the certificate authority 506, which is received by the certificate authority 506 in step 550. At step 552, registrant 502 sends an encrypted ballot to certification authority 506, which receives the encrypted ballot at step 554. In step 556, the certification authority 506 authenticates the source of the encrypted vote using the public key of the registrant 502 digitally signed by the registrar. This authentication validates the registrant's digital signature on the encrypted ballot. Thus, the protocol authenticates the encrypted ballot using the registrant 502's public key, which itself is authenticated using the digital signature of the registrar 504. The certification authority 506 may authenticate each vote when an encrypted vote is received, or delay the boat's authentication until the end of the voting period until all encrypted votes have been received. In step 558, the certification authority 506 aggregates the encrypted votes, and in step 560 decrypts these aggregated encrypted votes. The decryption is filed on March 24, 2000 and is filed under US Patent Application _________, entitled "MULTIWAY ELECTION METHOD AND APPARATUS" (Agent No. 32462.8001US). Achieved using the disclosed multiway protocol.

A similar subject matter was submitted on March 24, 2000, and the assigned U.S. Patent Application No. _________ entitled "MULTIWAY ELECTION METHOD AND APPARATUS" (Agent No. 32462.8001US) And the assigned US patent dated March 24, 2000, entitled "ELECTRONIC VOTING SCHEME EMPLOYING PERMANENT BALLOT STORAGE" (Agent Document No. 32462-8003US). Application No. _____, and Brewed Provisional Application No. 60 / 126,080, filed March 25, 1999 and Provisional Application No. 60 / 149,621, filed August 16, 1999.

While specific embodiments embodying the invention have been disclosed herein for purposes of illustration, various equivalent modifications may be made without departing from the spirit and scope of the invention as will be appreciated by those skilled in the art. The teachings provided herein can be applied to other registration systems, and are not necessary for the exemplary electoral registration protocol and the structures described above.

The various embodiments described above can be provided and combined in other embodiments. All US patents, patent applications, and publications mentioned herein are incorporated by reference. Aspects of the present invention may be modified, if necessary, of systems, circuits, and concepts of various patents, applications, and publications to provide other embodiments of the present invention.

These and other variations can be made by the description above. Generally, the terms used in the appended claims are not to be limited to the invention by the specific embodiments disclosed in the specification and claims, and all registrations should be intended to operate in accordance with the claims to register registrants. Accordingly, the invention is not limited to the disclosed subject matter, and the scope thereof should be determined entirely by the following claims.

Claims (40)

In the registration method, Receiving a hash and record signature of a public key of each of a plurality of registrants over a first communication channel comprising hand-delivery; Receiving public keys and associated identification information of at least some of the plurality of registrants over a second communication channel other than the first communication channel, excluding direct delivery; For each of the plurality of registrants, the public key if the hash of the public key of the registrant received over the first communication channel corresponds to the public key of the registrant received over the second communication channel. Digitally signing; And Providing the digitally signed public keys to a certificate authority. 2. The method of claim 1, further comprising: denying the registrant if the hash of the public key of the registrant received over the first communication channel does not correspond to the public key of the registrant received over the second communication channel. Registration method further comprising. 3. The method of claim 1 or 2, wherein receiving a hash and record signature of a public key over the first communication channel comprises receiving a write message via a courier. 3. The method of claim 1 or 2, wherein receiving a public key and associated identification information via the second communication channel comprises detecting a signal carried on at least one of an electrical, magnetic and electromagnetic carrier. 3. The method of claim 1 or 2, wherein the hash and record signature of the public keys of the registrants received over the first communication channel are non-electronic. 3. The method of claim 1 or 2, further comprising providing each of the registrants with a copy of each digitally signed public key. 3. The method of claim 1 or 2, further comprising generating a hash of the public key received via the second communication channel for comparison with a hash of the public key received via the first communication channel. How to register. 3. The registrant of claim 1 or 2, wherein only after the hash and record signature of the public key is received through the first communication channel, the registrants can submit the public key and associated identification information through the second communication channel. The registration method further comprising the step of. The method of claim 1 or 2, wherein the registrants do not allow the registrants to submit the public key and associated identification information through the second communication channel until a hash and record signature of the public key is received via the first communication channel. The registration method further comprising the step. 3. The method of claim 1 or 2, further comprising the step of entering a hash of the public key received via the first communication channel into an electronic database. A computer readable medium, For each of a plurality of voter registrants, receive a hash and record signature of the public key sent by the registrant via a first communication channel comprising direct delivery; Electronically receive, for each of at least some voter registrants of the plurality of voter registrants, a public key and associated identification information sent by the voter registrant via a second communication channel excluding direct delivery; For each of a plurality of voter registrants, digitally sign each public key of the registrant if the hash of the public key received from the voter registrant corresponds to the public key received from the voter registrant; And content for causing a computer to register voter registrants by providing the digitally signed public keys to a certification authority. 12. The system of claim 11, wherein a computer registers voter registrants by content by generating a hash of the public key received via the second communication channel to compare with a hash of the public key received via the first communication channel. Computer readable media. In the voter registration computer system, A public key hash input subsystem for each of a plurality of voter registrants, receiving a hash and record signature of the public key sent by the vote registrant via a first communication channel comprising direct delivery; A public key input subsystem for electronically receiving, for each of at least some voter registrants of the plurality of voter registrants, a public key and related identification information sent by the voter registrant via a second communication channel excluding direct delivery ; For each of a plurality of voter registrants, a digital signature sub that digitally signs each public key of the voter registrants if the hash of the public key received from the voter registrar corresponds to the public key received from the voter registrants. system; And And a digitally signed public key output subsystem for providing the digitally signed public keys to a certificate authority. 15. The voter registration of claim 13 further comprising a hashing subsystem that generates a hash of the public key received via the second communication channel for comparison with a hash of the public key received via the first communication channel. Computer system. 2. The method of claim 1, wherein the certification authority receives a plurality of digitally signed public keys from a registration authority, wherein each of the digitally signed public keys is associated with the public key via the first communication channel. Receiving a digitally signed public key belonging to each voter registrant of a plurality of voter registrants submitting a hash and submitting the public key corresponding to the hash over the second communication channel; And Authenticating the plurality of public key encrypted votes received from at least some voter registrants of the plurality of voter registrants using the received digitally signed public keys. 16. The method of claim 15, wherein the public key encrypted votes are digitally signed by the respective voter registrants. 12. The system of claim 11, wherein a plurality of digitally signed public keys are received from a registration authority of the certification authority, each of the digitally signed public keys receiving a hash of the public key via the first communication channel. Belonging to each voter registrant of the plurality of voter registrants submitting and submitting the public key corresponding to the hash over the second communication channel, A computer that allows a computer to register voter registrants by content by authenticating a plurality of public key encrypted votes received from at least some voter registrants of the plurality of voter registrants using the received digitally signed public keys. Readable Media. 18. The computer readable medium of claim 17, wherein the public key encrypted votes are digitally signed by each voter registrant. 18. The system of claim 13, wherein an input subsystem receives a plurality of digitally signed public keys from a registrar, each of the digitally signed public keys hashing the public key through the first communication channel. The input subsystem belonging to each voter registrant of a plurality of voter registrants submitting and submitting the public key corresponding to the hash over the second communication channel; And And an authentication subsystem for authenticating a plurality of public key encrypted votes received from at least some of the plurality of voter registrants using the received digitally signed public keys. 20. The voter registration computer system of claim 19, wherein the public key encrypted votes are digitally signed by the respective voter registrants. The method of claim 1, further comprising, for each of at least some of the plurality of registrants, directly identifying the identity of the registrant, The signature of the registrant and a hash of the public key are included on each hash card, and if the corresponding registrant is a verified registrant, the public key received from the registrant is digitally signed. 22. The method of claim 21, further comprising providing an acknowledged duplicate of each hash card to each of the verified registrants. 23. The method of claim 21 or 22 further comprising providing a copy of each digitally signed public key to each of the verified registrants. 23. The method of claim 21 or 22 further comprising rejecting the registrant if the hash on the hash card does not correspond to the public key received from the registrant. 23. The method of claim 21 or 22, further comprising providing a form for generating the hash card to at least some of the registrants. 23. The method of claim 21 or 22, further comprising providing a copy of public / private pair generation software to at least some of the registrants. 23. The method of claim 21 or 22, further comprising: prompting the registrant to generate the hash card; And Prompting the registrants to send the public key. 23. The method of claim 21 or 22, wherein directly identifying the registrant comprises comparing at least one of an image identification with the registrant and comparing a signature of the registrant's signature with the signature of the image identification. How to register. The method of claim 11, wherein for each of at least some of the plurality of registrants, an indication is received that the identity of the registrant has been directly verified, The public key hash and record signature submitted by the registrant are included on a hash card, and if the corresponding registrant is a verified registrant, the public key received from the registrant is digitally signed so that the computer A computer readable medium for registering voter registrants. 30. The computer readable medium of claim 29, wherein the computer registers voter registrants by content by automatically generating an approved copy of each hash card for each of the identified registrants. 31. The computer readable medium of claim 29 or 30, wherein the computer registers voter registrants by content by rejecting the registrant if the hash on the hash card does not correspond to the public key received from the registrant. 31. The computer readable medium of claim 29 or 30, wherein the computer automatically registers voter registrants by content by automatically providing a web page form for generating the hash card for at least some of the registrants. . 15. The system of claim 13, further comprising a tracking subsystem that, for each of at least some of the plurality of registrants, receives an indication that the registrant's identity has been directly verified; And the public key hash and record signature of the registrant are included on a hash card and the public key received from the registrant is digitally signed if the corresponding registrant is a verified registrant. 2. The method of claim 1, further comprising: receiving a plurality of digitally signed public keys from a registrar, wherein each of the digitally signed public keys belongs to each of a plurality of voter registrants, wherein the identity of each voter registrant is determined as described above. Wherein the hash card is submitted to the registrar, the hash card being directly verified by the registrar and including a public key hash and a record signature corresponding to the public key submitted electronically by the registrar to the registrar. Receiving public keys; And Authenticating the plurality of public key encrypted votes received from at least some of the plurality of voter registrants using the received digitally signed public keys. The method of claim 1, wherein the hash is based on any mathematical function. The method of claim 1, wherein the hash is based on an identification function. delete delete delete delete